File name:

1.exe

Full analysis: https://app.any.run/tasks/88b622e3-1586-4ffb-b2fe-44e73effad5a
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: July 07, 2024, 10:45:26
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
loader
purplefox
backdoor
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (console) Intel 80386, for MS Windows
MD5:

BB2B1CD32CFA51137D5EDE0892F76223

SHA1:

1E31B1BD8D72677498F9C4800C5321FA0C1D3B5D

SHA256:

3DC6414F1C8447A3A73A713D660BC7B7AB809A54FD4A1B7543C874B81D2AEA74

SSDEEP:

6144:aB1QWXQkN7z2NAH06pGkYnQFV10CU4/KqfC6cvvs6Ksd3Ha/NjUYyl5El9iqGuRU:Q1QWgkrgkYnAEqa60KsSNM6l9iog

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 1.exe (PID: 6156)

    • Changes the autorun value in the registry

      • A.exe (PID: 2992)

    • Connects to the CnC server

      • office.exe (PID: 1616)

    • PURPLEFOX has been detected (SURICATA)

      • office.exe (PID: 1616)

  • SUSPICIOUS

    • Likely accesses (executes) a file from the Public directory

      • Remover.exe (PID: 1388)
      • explorer.exe (PID: 1644)
      • A.exe (PID: 2992)

    • Executable content was dropped or overwritten

      • 1.exe (PID: 6156)

    • Connects to unusual port

      • 1.exe (PID: 6156)
      • office.exe (PID: 1616)

    • Potential Corporate Privacy Violation

      • 1.exe (PID: 6156)

    • Process requests binary or script from the Internet

      • 1.exe (PID: 6156)

    • Creates file in the systems drive root

      • explorer.exe (PID: 5504)

    • Executes application which crashes

      • Remover.exe (PID: 1388)

    • The process verifies whether the antivirus software is installed

      • A.exe (PID: 2992)

    • Contacting a server suspected of hosting an CnC

      • office.exe (PID: 1616)

  • INFO

    • Checks supported languages

      • 1.exe (PID: 6156)
      • Remover.exe (PID: 1388)
      • A.exe (PID: 2992)
      • office.exe (PID: 1616)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 5504)

    • Reads the computer name

      • A.exe (PID: 2992)
      • office.exe (PID: 1616)

    • Checks proxy server information

      • WerFault.exe (PID: 6184)
      • slui.exe (PID: 6160)

    • Reads the software policy settings

      • WerFault.exe (PID: 6184)
      • slui.exe (PID: 6160)
      • slui.exe (PID: 4680)

    • Reads CPU info

      • office.exe (PID: 1616)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:06:20 11:50:59+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 299520
InitializedDataSize: 108032
UninitializedDataSize: -
EntryPoint: 0x208f0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
150
Monitored processes
13
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 1.exe conhost.exe no specs sppextcomobj.exe no specs slui.exe remover.exe explorer.exe no specs explorer.exe no specs rundll32.exe no specs werfault.exe a.exe #PURPLEFOX office.exe conhost.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
1388C:\Users\Public\serupdate\Remover.exeC:\Users\Public\serupdate\Remover.exe
1.exe
User:
admin
Integrity Level:
MEDIUM
Description:
bypass02
Version:
1, 0, 0, 1
Modules
Images
c:\users\public\serupdate\remover.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1616office.exeC:\Users\Public\serupdate\office.exe
A.exe
User:
admin
Company:
网易灵犀
Integrity Level:
MEDIUM
Description:
网易灵犀办公
Version:
1.40.2
Modules
Images
c:\users\public\serupdate\office.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ucrtbase.dll
1644explorer.exe C:\Users\Public\serupdateC:\Windows\SysWOW64\explorer.exe—Remover.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcp_win.dll
2992"C:\Users\Public\serupdate\A.exe" C:\Users\Public\serupdate\A.exe
explorer.exe
User:
admin
Company:
G DATA Software AG
Integrity Level:
MEDIUM
Description:
G DATA AntiSpam UI
Exit code:
243974658
Version:
25.1.24025.1146
Modules
Images
c:\users\public\serupdate\a.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3168\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—office.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4680"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4800C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
5504C:\WINDOWS\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -EmbeddingC:\Windows\explorer.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\twinapi.dll
c:\windows\system32\oleaut32.dll
6156"C:\Users\admin\Desktop\1.exe" C:\Users\admin\Desktop\1.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ucrtbase.dll
6160C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
17 558
Read events
17 512
Write events
44
Delete events
2

Modification events

(PID) Process:(5504) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:NodeSlots
Value:
0202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202
(PID) Process:(5504) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:MRUListEx
Value:
040000000E00000003000000000000000C0000000D0000000B000000050000000A000000090000000800000001000000070000000600000002000000FFFFFFFF
(PID) Process:(5504) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar
Operation:writeName:Locked
Value:
1
(PID) Process:(5504) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Ribbon
Operation:writeName:MinimizedStateTabletModeOff
Value:
0
(PID) Process:(5504) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Ribbon
Operation:writeName:QatItems
Value:
3C7369713A637573746F6D554920786D6C6E733A7369713D22687474703A2F2F736368656D61732E6D6963726F736F66742E636F6D2F77696E646F77732F323030392F726962626F6E2F716174223E3C7369713A726962626F6E206D696E696D697A65643D2266616C7365223E3C7369713A71617420706F736974696F6E3D2230223E3C7369713A736861726564436F6E74726F6C733E3C7369713A636F6E74726F6C206964513D227369713A3136313238222076697369626C653D2266616C73652220617267756D656E743D223022202F3E3C7369713A636F6E74726F6C206964513D227369713A3136313239222076697369626C653D2266616C73652220617267756D656E743D223022202F3E3C7369713A636F6E74726F6C206964513D227369713A3132333532222076697369626C653D2266616C73652220617267756D656E743D223022202F3E3C7369713A636F6E74726F6C206964513D227369713A3132333834222076697369626C653D22747275652220617267756D656E743D223022202F3E3C7369713A636F6E74726F6C206964513D227369713A3132333336222076697369626C653D22747275652220617267756D656E743D223022202F3E3C7369713A636F6E74726F6C206964513D227369713A3132333537222076697369626C653D2266616C73652220617267756D656E743D223022202F3E3C2F7369713A736861726564436F6E74726F6C733E3C2F7369713A7161743E3C2F7369713A726962626F6E3E3C2F7369713A637573746F6D55493E
(PID) Process:(5504) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser
Operation:writeName:ITBar7Layout
Value:
13000000000000000000000020000000100000000000000001000000010700005E01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5504) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\0\4
Operation:writeName:1
Value:
7C00310000000000E758B55511005075626C69630000660009000400EFBE874FDB49E758B9552E0000005AC700000000030000000000000000003C000000000016C61A015000750062006C0069006300000040007300680065006C006C00330032002E0064006C006C002C002D0032003100380031003600000016000000
(PID) Process:(5504) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\0\4\1
Operation:delete valueName:MRUList
Value:
(PID) Process:(5504) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\0\4
Operation:writeName:MRUListEx
Value:
0100000000000000FFFFFFFF
(PID) Process:(5504) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\0\4\1
Operation:writeName:0
Value:
5C00310000000000E758B95510005345525550447E310000440009000400EFBEE758B555E758B9552E000000475F05000000090000000000000000000000000000005C34B400730065007200750070006400610074006500000018000000
Executable files
4
Suspicious files
4
Text files
2
Unknown types
1

Dropped files

PID
Process
Filename
Type
6184WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_Remover.exe_70db5ed651cac3d44cd3c0bcfdd88c8cb26b26_3aff6587_39107036-fc4a-4c7b-bd56-631f63b768a2\Report.wer —
MD5:—
SHA256:—
6184WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER5576.tmp.WERInternalMetadata.xmlxml
MD5:6B983C8035126651DDE722E8198ED298
SHA256:FEA9D3E84F91FF735EB835ECA5802ABD397EC37EDC72CF9076C9394F35128D93
6184WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER5597.tmp.xmlxml
MD5:93F5B290A04395FF8396F3A4296B9299
SHA256:96E1B720AB062A2F19033ECB9023EDE8AB31FAA651BCEE834BD76E243DF53E59
61561.exeC:\Users\Public\serupdate\ask.dllexecutable
MD5:544728F37DC9E4A605CF143748DB4BB1
SHA256:4010B3F5DA5D7CE3DADEC745ACBAB6A49469CF17BC7E864CFE4400281F683838
6184WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\21253908F3CB05D51B1C2DA8B681A785der
MD5:979F91388D4DF2F2D68497400C9830DD
SHA256:A9F27E26AA818BC97449D30D5707254EDCA571D21D36B4576C7CD9A56FB18BC5
61561.exeC:\Users\Public\serupdate\office.exeexecutable
MD5:5DEE06E2307259C4628B8AE213C80492
SHA256:ED746438D971E50835C87707945102A52E1FE763FCB576869E08807D425F9511
6184WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER549B.tmp.dmpdmp
MD5:F434609E47E7F0FA09BE72CF1089D9A0
SHA256:3FD312D200EA69DCA7ECD64FD121D0B1B2A9FE9A7B060DEE478FBFEAA4AFBE7F
61561.exeC:\Users\Public\serupdate\A.exeexecutable
MD5:90372D5D20E02DBACEA89C48DDD1F200
SHA256:FC66BB6617584CC8EACBCEA1CC4D2DFA4890B89F5AFB643B21647EFE7F516B39
6184WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785binary
MD5:0995F39A10276B1384C1BF4039D7E402
SHA256:883C780A3B664D1D308BD6599788282D0593BCDA33425E66EBB2E146BDA7A219
6184WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FEbinary
MD5:3DD951AABBD4B058F5A30CA3CC13AB0A
SHA256:FB56BE35631713DDB37AE52079F260982D2D665134BD95910628608E9923037E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
62
DNS requests
16
Threats
27

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6156
1.exe
GET
200
104.233.187.248:3000
http://104.233.187.248:3000/Public/ask.dll
unknown
—
—
unknown
6156
1.exe
GET
200
104.233.187.248:3000
http://104.233.187.248:3000/Public/A.exe
unknown
—
—
unknown
6324
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
2456
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
6156
1.exe
GET
200
104.233.187.248:3000
http://104.233.187.248:3000/Public/Remover.exe
unknown
—
—
unknown
6408
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
6156
1.exe
GET
200
104.233.187.248:3000
http://104.233.187.248:3000/Public/office.exe
unknown
—
—
unknown
6788
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
6788
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
6184
WerFault.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6004
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2032
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
188
RUXIMICS.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2456
svchost.exe
40.126.32.138:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2456
svchost.exe
192.229.221.95:80
—
EDGECAST
US
whitelisted
1060
svchost.exe
23.35.238.131:443
go.microsoft.com
AKAMAI-AS
DE
unknown
3040
OfficeClickToRun.exe
52.111.227.11:443
nexusrules.officeapps.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown

DNS requests

Domain
IP
Reputation
login.live.com
  • 40.126.32.138
  • 20.190.160.20
  • 40.126.32.74
  • 20.190.160.14
  • 40.126.32.133
  • 40.126.32.76
  • 20.190.160.22
  • 40.126.32.72
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.11
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
fd.api.iris.microsoft.com
  • 20.31.169.57
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted

Threats

PID
Process
Class
Message
6156
1.exe
A Network Trojan was detected
ET MALWARE Single char EXE direct download likely trojan (multiple families)
6156
1.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
6156
1.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
6156
1.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
6156
1.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
6156
1.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
6156
1.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
6156
1.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
6156
1.exe
Misc activity
ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)
6156
1.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
10 ETPRO signatures available at the full report
No debug info